FortiGuard downloads recover and existing managed-device connections stay healthy. That observation is relevant for the separate case a FortiManager cannot download updates after a proxy configuration change, while device management over FGFM remains healthy. Here the decisive evidence is resource monitoring identifies the process or scheduled load responsible for the slowdown.

Integrity reports pass and subsequent package operations complete without database faults. That observation is relevant for the separate case after unexpected power loss, FortiManager displays inconsistent database errors in installation tasks. Here the decisive evidence is resource monitoring identifies the process or scheduled load responsible for the slowdown.

Management connections remain stable under the monitored test period with expected keepalives. That observation is relevant for the separate case multiple managed FortiGates disconnect periodically but no physical interface alarms exist on FortiManager. Here the decisive evidence is resource monitoring identifies the process or scheduled load responsible for the slowdown.

The required object is restored without overwriting unrelated current settings. That observation is relevant for the separate case after a configuration outage, an engineer wants to restore one changed object but proposes replacing all FortiManager device records. Here the decisive evidence is the chosen revision preserves the correct VPN and interface topology for the current cluster.

The revision comparison identifies the local-only change and its intended disposition. That observation is relevant for the separate case a FortiGate policy changed locally but FortiManager shows an older managed configuration revision. Here the decisive evidence is the chosen revision preserves the correct VPN and interface topology for the current cluster.

The investigation distinguishes a device-level drift issue from pending package deployment. That observation is relevant for the separate case a managed FortiGate reports a configuration conflict while its policy package status says modifications remain pending. Here the decisive evidence is the chosen revision preserves the correct VPN and interface topology for the current cluster.

Script execution history shows successful configuration on precisely the intended gateways. That observation is relevant for the separate case an engineer plans to change the same NTP server on 60 gateways using manual command-line sessions. Here the decisive evidence is the run log contains required device diagnostic output and shows no configuration changes.

The retry affects only the originally intended gateway and produces a new recorded result. That observation is relevant for the separate case a support engineer reruns an old script against the entire ADOM instead of the one affected device. Here the decisive evidence is the run log contains required device diagnostic output and shows no configuration changes.

Each eligible test device accepts the script without command errors. That observation is relevant for the separate case a FortiManager script succeeds on one test firewall but fails on an older FortiOS version in another site. Here the decisive evidence is the run log contains required device diagnostic output and shows no configuration changes.

Global policy packages can surround local domain policies with header and footer sections. This mechanism instead applies when a service provider needs global mandatory cleanup rules to appear after a customer's local firewall policy. The current correction relies on global policy header sections precede inserted local ADOM policy rules after assignment.

Each local policy package can have one assigned global policy package under supported rules. This mechanism instead applies when an administrator attempts to assign two separate global policy packages to one individual local policy package simultaneously. The current correction relies on global policy header sections precede inserted local ADOM policy rules after assignment.

Global Database rules participate in ADOM policy installation only through explicit assignment. This mechanism instead applies when a global policy is created in FortiManager but is not visible when installing a tenant ADOM package. The current correction relies on global policy header sections precede inserted local ADOM policy rules after assignment.

Supply the validated device identifier or choose a documented supported model-device provisioning method. This can be appropriate when an offline model device has no known serial number and the selected onboarding method requires a serial match. It does not directly address the present situation, where the required correction is verify network routing and required FGFM service reachability between the gateway and FortiManager.

Apply a supported system template to the correct managed devices or device group. This can be appropriate when a fleet of branch appliances requires identical DNS and NTP settings but is being configured by hand on every unit. It does not directly address the present situation, where the required correction is verify network routing and required FGFM service reachability between the gateway and FortiManager.

Reassign the managed device through a supported ADOM move after validating target packages and permissions. This can be appropriate when an administrator imports a FortiGate into the wrong tenant ADOM and later notices a policy scope mismatch. It does not directly address the present situation, where the required correction is verify network routing and required FGFM service reachability between the gateway and FortiManager.

Approving unrelated device differences can disrupt production services. That consequence is more specific to a policy installation preview displays unexpected changes to DNS configuration on a target firewall. For this case, the most direct exposure is blind installation retries increase noise without addressing the underlying configuration fault.

Cross-ADOM object mismatch can produce rejected installations or incorrect access decisions. That consequence is more specific to an administrator moves a FortiGate to another ADOM and then installs an old package that still contains source-ADOM objects. For this case, the most direct exposure is blind installation retries increase noise without addressing the underlying configuration fault.

Leaving a restored firewall without its required installed policy can create enforcement drift. That consequence is more specific to a production gateway has an approved policy package that needs reinstallation after an out-of-band device restore. For this case, the most direct exposure is blind installation retries increase noise without addressing the underlying configuration fault.

Apply narrowly scoped per-policy installation targeting for that sensitive rule. This can be appropriate when a security team wants a single policy package to serve three device populations, but only two are approved for a sensitive rule. It does not directly address the present situation, where the required correction is complete the approved policy package installation for the affected managed device.

Remove or constrain the temporary rule through an authorized policy change and installation. This can be appropriate when a security review finds a policy package has an unapproved accept-any temporary rule left from testing. It does not directly address the present situation, where the required correction is complete the approved policy package installation for the affected managed device.

Reconcile imported objects and dynamic mappings against the destination network topology. This can be appropriate when an administrator copies a policy rule from another ADOM without updating addresses for the new location. It does not directly address the present situation, where the required correction is complete the approved policy package installation for the affected managed device.

The remote FortiGate resolves a reachable manager endpoint and maintains central management status. That observation is relevant for the separate case a management network uses split-horizon DNS, but remote FortiGates resolve the FortiManager name to an unreachable inside address. Here the decisive evidence is remote gateways reach the intended manager and finish authorized device registration.

A management session is established using the approved reachable endpoint across NAT. That observation is relevant for the separate case a FortiGate behind a branch NAT device cannot establish central management to FortiManager at headquarters. Here the decisive evidence is remote gateways reach the intended manager and finish authorized device registration.

Authorized administrators can sign in and registered devices retain only necessary management flows. That observation is relevant for the separate case a company places FortiManager in a dedicated management segment but opens its GUI to all public networks for convenience. Here the decisive evidence is remote gateways reach the intended manager and finish authorized device registration.

Installation targets are maintained in ADOM-scoped policy management records. This mechanism instead applies when an administrator expects a FortiGate moved between ADOMs to retain an old package's installation targets automatically. The current correction relies on workspace mode serializes configuration edits through locks on supported resources.

Workflow mode introduces an approval lifecycle beyond ordinary workspace locking. This mechanism instead applies when an MSSP needs approval before policy changes become deployable in sensitive customer ADOMs. The current correction relies on workspace mode serializes configuration edits through locks on supported resources.

Session monitoring links concurrent administrative activity to resource lock state. This mechanism instead applies when a user needs to identify which administrator session holds a lock before emergency maintenance. The current correction relies on workspace mode serializes configuration edits through locks on supported resources.

Dynamic interface maps resolve generic rule fields to device-specific interfaces. This mechanism instead applies when a policy package includes two similarly named interface mappings and engineers are unsure which target uses each one. The current correction relies on per-policy target scoping can control distribution within a centrally managed package.

FortiManager tracks central policy changes and device installation state separately. This mechanism instead applies when an imported firewall policy package is marked modified after central editing but the operator assumes the target is synchronized. The current correction relies on per-policy target scoping can control distribution within a centrally managed package.

Policy content must be interpreted against the feature set supported by the target FortiOS version. This mechanism instead applies when a customer upgrades FortiOS but its central package still contains features unsupported by the target's firmware. The current correction relies on per-policy target scoping can control distribution within a centrally managed package.

A proposed session remains pending until the authorized approval process completes. That observation is relevant for the separate case an MSSP needs approval before policy changes become deployable in sensitive customer ADOMs. Here the decisive evidence is a second operator is prevented from conflicting edits while the first holds the authorized lock.

The active session list identifies the owner and the policy package or ADOM being held. That observation is relevant for the separate case a user needs to identify which administrator session holds a lock before emergency maintenance. Here the decisive evidence is a second operator is prevented from conflicting edits while the first holds the authorized lock.

The destination package lists the intended FortiGate and excludes obsolete assignment records. That observation is relevant for the separate case an administrator expects a FortiGate moved between ADOMs to retain an old package's installation targets automatically. Here the decisive evidence is a second operator is prevented from conflicting edits while the first holds the authorized lock.